RE: [PHP] Storing Social Security Number WAS: Encryption/Decryption Question

On Thu, 2010-08-12 at 09:45 -0400, tedd wrote: > At 5:30 PM -0700 8/11/10, Daevid Vincent wrote: > > > -----Original Message----- > >> 2. Were told it was a social security number > >> (i.e., in the form of 123-45-6789). > > > >Stop. > > > >Why are you even contemplating storing SS# ?? > > Daevid et al: > > Why? Because my client wants to store SS numbers on their online > system to aid them in their collection business. > > You see, the client in this case is not asking people for their SS > numbers, but rather trying to collect unpaid debts. Their clients > (i.e., creditors) have provided them debtor data, which may/may not > include SS numbers. > > My current thoughts are that the entire process will be behind a > password protected section of a web site where only the people > working for the firm will have access. The point of the system will > be to aid collectors in their collection efforts and to allow them to > conduct business anywhere they can find Internet access. > > Of course, this will not stop employees from abusing the data, but > that possibility also exist in the hard-copy only office as well -- > that's a criminal act and will be handled accordingly. The difference > here is that the data can be accessed online via password > authorization. Is that too easy? > > My effort here with my "Encryption/Decryption Question" is to focus > on the event that the web site may hacked and access to the database > is provided to an intruder. In such case, then the SS numbers > residing there should be encrypted and that was my current quest to > resolve. > > Now, if federal law prohibits storing SS numbers in an online > database that's accessible via password authorization then that's > "end-of-story". I'll simply tell the client that federal law > prohibits such practice and that will be the end of it -- it makes no > difference to me. > > However, if the practice of storing SS number online is not > prohibited by law, then what are the appropriate "due diligence" > steps necessary to protect such data? > > Cheers, > > tedd > > -- > ------- > http://sperling.com/ > If you are storing the data in a DB, then I'd consider using different levels of access to that via different DB users, which should offer an extra layer of security in protecting the data. In the UK, I believe you are allowed to store details such as these in an online system, but the whole server itself has to pass a PCI check, which ensures that various server modules are up-to-date, etc, which should hopefully block another hole or two. Thanks, Ash http://www.ashleysheridan.co.uk